Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
High 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
-
High 7.1
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible …
-
High 7.8
In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted …
-
Medium 6.3
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI sch…
-
High 8.4
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host a…
-
Low 3.7
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
-
Low 3.1
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
-
Medium 5.5
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
-
High 8.1
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
-
Medium 4.8
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
-
Low 3.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
-
High 7.0
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
-
Medium 5.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview w…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown prev…
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories …
-
Medium 6.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configuratio…
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
-
High 7.5
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote…
-
High 7.4
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store dur…
-
High 8.2
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted pro…
-
Low 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
-
Low 2.7
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module gr…
-
Medium 6.8
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
-
Medium 5.0
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
-
High 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoi…
-
High 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
-
Low 2.7
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform …
-
Critical 9.6
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during …
-
Medium 5.3
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactiv…
-
Medium 4.3
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs noteb…
-
Medium 5.4
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
-
Medium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
-
Medium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
-
Medium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published int…
-
Medium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…